CVE-2017-8913: Improper Restriction of XML External Entity Reference

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

PT-2017-18690

Name of the Vulnerable Software and Affected Versions Dropbear versions prior to 2017.75 Dropbear affected versions not specified is not applicable here as we have specific version information. Description The issue allows local users to read certain files as root, given that the file has the...

Log injection in SAP NetWeaver AS Java using basic auth

Application: SAP NetWeaver AS Java Versions Affected: ENGINEAPI 7.10-7.50 Vendor URL: SAP Bug: Log Injection Reported: 17.05.2017 Vendor response: 18.05.2017 Date of Public Advisory: 14.11.2017 Reference: SAP Security Note 2485208 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

Google Android system service ContentService suffers from a null object reference vulnerability

Google Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Consortium. A null object reference vulnerability exists in the Google Android system service ContentService. The vulnerability stems from an exception in the parameters passed to t...

Randstad Group Selects Trend Micro to Protect its Public Cloud Infrastructure

The Randstad Group is currently in the process of consolidating and centralizing its IT infrastructure across 30 IT departments, and will be providing service to more than 40 operating countries across four continents. To ensure the new infrastructure will have optimal security the company select...

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update F)

CVSS v3 6.5 ATTENTION: Exploitable from an adjacent network/low skill level to exploit. Vendor: Siemens Equipment: Devices using the PROFINET Discovery and Configuration Protocol DCP Vulnerability: Denial of Service UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory...

as-built.be XSS vulnerability

Vulnerable URL: http://www.as-built.be/photo.php?id=12=3"'--! Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check as-built.be SSL...

How organizations can protect against new CERBER variations

TrendMicro Ransomware hit hard in 2016, with big attacks, large payouts and many new strains developed to thwart security measures. At the end of last year, Locky and CERBER ransomware families seemed to be neck and neck for market dominance. But that changed as CERBER evolved to offer new...

Fuze Patches Bug That Exposed Recordings of Private Business Meetings

Fuze, an enterprise-grade voice and video collaboration platform, has patched a vulnerability that exposed recordings of private meetings. A fix was made server-side by Fuze, and a patch was pushed to its endpoint client apps within 11 days of being privately notified by researchers at Rapid7...

PT-2017-9710

Name of the Vulnerable Software and Affected Versions Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and earlier Description The issue allows remote authenticated users to execute arbitrary code as the root user. This is achieved by using shell metacharacters in the cache id parameter...

Original XPan Ransomware Returns, Targets Brazilian SMBs

Brazilian cybercriminals are using the original version of the XPan ransomware, targeting small to medium-sized business based in Brazil with the malware. XPan works by penetrating poorly protected remote desktop protocol RDP connections. Hackers use those connections to manually install the...

CVE-2017-1122

IBM Security Guardium 8.2, 9.0, and 10.0 contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary commands which would be executed as root. IBM X-Force ID: 121174...

TaBi - Track BGP Hijacks

Developed since 2011 for the needs of the French Internet Resilience Observatory , TaBi is a framework that ease the detection of BGP IP prefixes conflicts, and their classification into BGP hijacking events. The term prefix hijacking refers to an event when an AS, called an hijacking AS ,...

Russian Hacker Selling Cheap Ransomware-as-a-Service On Dark Web

Ransomware has been around for a few years, but it has become an albatross around everyone's neck, targeting businesses, hospitals, financial institutions and individuals worldwide and extorting millions of dollars. Forget about developing sophisticated banking trojans and malware to steal money...

Sql injection

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

CVE-2017-7696

CVE-2017-7696 affects SAP AS JAVA SSO Authentication Library versions 2.0–3.0. A remote attacker can trigger a denial-of-service by sending a request that causes the server to generate a very large image via otp_logon_ui_resources/qr (e.g., width/height parameters). The issue is a memory exhausti...

CVE-2017-7717

The CVE-2017-7717 entry concerns SAP NetWeaver AS Java 7.4, specifically the ES UDDI component. The vulnerability arises in the getUserUddiElements method, described as an SQL injection that permits remote authenticated users to execute arbitrary SQL commands via unspecified vectors. This is supp...

CVE-2017-7717: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

CVE-2017-7696: Allocation of Resources Without Limits or Throttling

SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service memory consumption via large values in the width and height parameters to otplogonuiresources/qr, aka SAP Security Note 2389042...

PT-2017-17903

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java version 7.4 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is due to a SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component. Recommendatio...